Category: Cyber Security News

The FBI has seized the domains of NightmareStresser, one of the longest-running DDoS-for-hire platforms, as part of Operation PowerOFF. The service allegedly enabled hundreds of thousands of attacks worldwide using rented botnets and IoT devices, and previous actions have already disrupted other booter services and arrested multiple suspects. #NightmareStresser #OperationPowerOFF #FBI

Microsoft warned that Windows 11 24H2 Home and Pro editions will stop receiving updates on October 13, 2026, and urged users to move to Windows 11 25H2. Enterprise and Education editions of Windows 11 24H2 remain supported until October 2027. #Windows11 #Windows1124H2 #Windows1125H2

Google Threat Intelligence Group reported that AI is rapidly lowering the cost and time needed for credential theft, including a campaign that compromised thousands of third-party credentials in under six hours. The article warns that strong password hygiene is not enough on its own and emphasizes device trust as a critical defense against AI-enabled abuse of stolen credentials. #GoogleThreatIntelligenceGroup #SpecopsPasswordAuditor #SpecopsDeviceTrust #Unit42 #Microsoft

Hackers are demanding $3 million from Revolut after using fake government requests over several months to siphon customer data, including passports, email addresses, phone numbers, and financial information. The campaign is linked to the compromised account of an Italian government employee and reportedly affected around 680 Revolut customers, while Italy’s police…

Riverbed has launched Network 360, a new set of intelligent network observability solutions that combine expanded visibility with agentic AI to speed troubleshooting, identify root causes, and predict issues before users are affected. The offering integrates Riverbed IQ and Q into AppResponse and NetProfiler, while NPM+ extends coverage across remote users, Zero Trust, and public cloud environments. #Riverbed #RiverbedIQ #RiverbedQ #AppResponse #NetProfiler #NPMplus #Aternity

HP identified a fake AI crypto trading agent website that delivered Needle Stealer, which swaps browser wallet extensions to steal passwords and give attackers control of funds. The company also tracked QR code phishing, Phantom Stealer, and other fake installer campaigns that used image-based payloads, DLL side-loading, and process injection to spread theft tools. #NeedleStealer #PhantomStealer #MetaMask #CoinbaseWallet #Phantom #TradingClaw #CloudflareTurnstile #OneDrive #XWorm #PureLogsStealer #Formbook

Spain’s AEPD reported its first data breach allegedly caused by an autonomous AI agent that scanned a company network, found a flaw, altered personal records, and accessed invoice data. The incident highlights how AI agents are accelerating offensive operations, with related cases also involving Hugging Face and Anthropic during security evaluations. #AEPD #HuggingFace #Anthropic

Cisco has released emergency security updates for CVE-2026-76460, a maximum-severity authentication bypass flaw in Cisco Identity Services Engine (ISE) and ISE-PIC that attackers are actively exploiting. The company and CISA urged immediate patching, with Cisco also advising admins to hunt for signs of compromise and re-image affected systems if suspicious activity is found. #CiscoISE #CVE-2026-76460 #CISA

Microsoft has shared a temporary workaround for a Windows 11 issue caused by the September 2026 security updates that blocks some users from signing in with valid domain credentials. The problem is tied to Machine Identity Isolation enforcement and can break domain trust on affected enterprise systems, especially outside Windows Server 2025 DFL environments. #Microsoft #Windows11 #MachineIdentityIsolation #KB5124008 #KB5124012

FamousSparrow has been using a new C++ backdoor called SparroWocky to spy on government organizations across Latin America, replacing its older SparrowDoor malware. ESET says the campaign has targeted multiple countries and appears aimed at gathering intelligence on how Latin American governments respond to U.S. pressure on Chinese economic interests. #FamousSparrow #SparroWocky #SparrowDoor #ESET

Cisco released urgent patches for a critical authentication bypass flaw in Identity Services Engine (ISE) and ISE-PIC, tracked as CVE-2026-76460, after confirming active zero-day exploitation. The vulnerability can let attackers bypass the management interface, gain root access, and hide evidence of compromise, prompting CISA to add it to the KEV catalog…

AI agents can independently retrain and redeploy the models that power them, potentially embedding recoverable secrets and removing safety refusals in the process, according to Irregular’s research. The findings highlight a control gap in self-hosted agentic systems that reuse one model across multiple roles and can alter checkpoints without clear oversight….

CISA has released new guidance on using cyber decoys to help critical infrastructure organizations detect, distract, and study adversaries who may already have some level of access. The guidance explains how decoys, honeypots, honeytokens, and related techniques can improve visibility into attacker behavior and strengthen detection and response. #CISA #ZeroTrust #honeytokens…

Kaspersky reported that three threat clusters—NightEagle, Hacking Cat, and Toy Ghouls—are targeting Russian enterprises with new persistence, lateral movement, ransomware, wiper, and backdoor capabilities. The campaigns use tools such as GhostContainer, Gorilla RAT, Monkey ransomware, ClearWater, Nemo Wiper, and Bird Agent to compromise Microsoft Exchange, Active Directory, and other enterprise systems….

A critical flaw in Issabel Framework, tracked as CVE-2026-89026, is being actively exploited to let unauthenticated attackers execute arbitrary OS commands by forging JWT bearer tokens with a hard-coded signing key. A patch released on August 1, 2026, replaces the shared key, while Shadowserver Foundation first observed exploitation on September 9,…